PROPOSED NEW CRITERIA - Support statement

[SecurityCRob]

We should consider adding a Lvl 1 DOCUMENTATION criteria that speaks to the need to have a published support statement/policy.

It could read something like:
"The PROJECT DOCUMENTATION MUST include a descriptive statement about how the project is supported/maintained and what is not supported. Projects are encouraged to provide "End of Support" statements when versions or features are deprecated or no longer supported."

[eddie-knight]

Though it needs revised, there is a Security Insights section related to this:

https://github.com/ossf/security-insights-spec/blob/main/specification/project-lifecycle.md#project-lifecycle